higgsfield-recipes
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
curlto download generated media assets from remote URLs and save them to the local filesystem (e.g.,brands/<slug>/assets/). This is a documented functional requirement for maintaining offline-deterministic builds for landing pages. - [PROMPT_INJECTION]: Prompt templates in
prompts.mdutilize variable interpolation (e.g.,{{name}},{{pitch}},{{saas.jtbd}}) to customize generation. While these ingestion points could theoretically be used for indirect prompt injection to influence the visual output, the surface is limited to generative model parameters. - Ingestion points: Variable placeholders in
prompts.md(e.g.,{{name}},{{pitch}}). - Boundary markers: None; variables are placed directly within the natural language prompt bodies.
- Capability inventory: Includes file-system writing and
curlcommand execution inSKILL.md. - Sanitization: No explicit sanitization logic is present, but the instructions emphasize strict adherence to specified model parameters and output types.
Audit Metadata